APRA chair John Lonsdale framed Australia’s exposure as structural – stressing that the economy could not insulate itself from global turbulence.

“As a mid-size trade-exposed economy, Australia will always be impacted by what happens in the rest of the world – and right now, the rest of the world is becoming more volatile and unpredictable,” he said.

That assessment underpins APRA’s decision to set out a clear baseline for what satisfactory geopolitical risk management looks like across governance and risk processes.

Gaps APRA is seeing in current practice

Drawing on feedback from other members of the Council of Financial Regulators, APRA said most banks now acknowledged geopolitical risk in principle – but added that this recognition was often not reflected in practical decision making.

It stated that business strategies and credit policies, for example, largely did not consider what would occur if a key jurisdiction imposed sanctions or restricted capital flows.

The regulator is also worried about the way new less-traditional threats are being handled.

It noted that risk frameworks had not kept pace with issues such as insider threats, staff security risks and disinformation campaigns.

Another area of concern is crisis testing, with APRA pointing out that scenario exercises were growingly narrow, overly infrequent or not severe enough.

What APRA expects to see from lenders

In the letter, APRA laid out six focus areas it expects lenders to strengthen.

One area relates to non‑financial channels, such as foreign interference and cyber attacks linked to geopolitical disputes.

Another focuses on capital and liquidity planning, funding diversification and investment stress testing under scenarios involving geopolitical threats.

Lonsdale made it clear that the regulator viewed this as a line‑in‑the‑sand moment.

“This letter is a clear call to action as awareness is not enough. We need to see APRA-regulated entities integrate geopolitical risk into governance, risk management and crisis preparedness practices to strengthen their readiness for geopolitical shocks,” he said.

“Where APRA identifies heightened exposure, weak governance, or inadequate preparedness, we will take appropriate supervisory action to address these gaps.”

Targeted reviews for higher‑risk entities

APRA stressed that the expectations did not amount to a new prudential standard yet rather clarified how lenders should be applying the existing rules in relation to geopolitical events.

The regulator said it planned to write separately to a group of larger institutions it considers having elevated exposure to geopolitical developments.

Those entities will be asked to complete a readiness assessment, with a focus on crisis playbooks, staff‑related risks and the political‑risk channels that could affect their business models.

Smaller or less exposed entities will not face the same level of scrutiny, but APRA signalled that all regulated lenders were expected to respond in a way that is proportionate to their risk profile.

This story was originally published by Cyber Daily’s sister brand, The Adviser.